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Decoded prope^fe 
values 


r 


o 

e 




T3 




ITLB 
property bi 


< 


'0 
.1 0 

8w 


Protected 


Interpretation 

1 


Instructions sei 


Collect prof 
trace-packel 


Probe for 
translated co 


I/O memor] 
reference 
exceptions 


00 


Tap 


Tap 


no 


Native code observing native 
RISCy calling conventions 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


01 


Tap 


x86 


no 


Native code observing x86 
calling conventions 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


10 


x86 


x86 


no 


x86 code, unprotected - 
TAX! profile collection only 


x86HW 
converter 


If enabled 


No 


Trap 
if profiling 


11 


x86 


x86 


yes 


x86 code, protected - 
TAX! code may be available 


x86HW 
converter 


If enabled 


Based on I- 
TLB probe 
attributes 


Trap 
if profiling 



1^; 162,- 




Fitfi ' 2a Significance of the I-TLB property bits 



Ul 

I UJ 



Transition ( source => dest ) 
ISA & CC property values 


Handler Action 


00 => 00 


No transition exception 


00 =>01 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions 


00 => Ix 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions, 

sets up expected emulator and profiling state 


01 => 00 


VECT_xxx_TAP_CC exception - handler converts from x86 to native conventions 


01 =>0I 


No transition exception 


01 => Ix 


VECT_X86_ISA exception [conditional based on PCW.X86JSA_ENABLE flag] 
- sets up expected emulator and profiling state 


lx=> 00 


VECT_xxx_TAP_CC exception - handler converts from .x86 to native conventions 


lx=>01 


VECT_TAP_IS A exception [conditional based PCW.TAPJSA^ENABLE flag] 
- no convention conversion necessary 


Ix=> 10 


No transition exception - [profile complete possible, probe possible] 


lx=>ll 


No transition exception - [profile complete possible, probe NOT possible] 



ISA & CC transition exception flow 



name 


description 


type 


VECT_calLX86_CC 


push args, return address, set up x86 state 


fault on target instruction 


VECTJump_X86_CC 


set up x86 state 


fault on target instruction 


^ VECT_ret_no_fp_X86_CC 


return value to eax:edx, set up x86 state 


fault on target instruction 


VECT_ret_fp^X86„CC 


return value to x86 fp stack, set up x86 state 


fault on target instruction 


VECT_call_TAP_CC 


x86 stack args, return address to registers 


fault on target instruction 


VECTJump_TAP_CC 


x86 stack args to registers 


fault on target instruction 


VECT_ret_no_fp_TAP_CC 


return value to RVO 


fault on target instruction 


VECT_ret_any_TAP_CC 


return type unknown, setup RVO and RVDP 


fault on target instruction 



CC transition exceptions 



4 U 




r T 



save. "I^rc^trv ^Ah>^ 



Flat 32-bit "Near" Address Space 



x86? RISC? 1 



Transparency: 

. x86 code adheres to traditional 

x86 stack-based conventions 
. RISC uses higher performance 

register-based conventions 
. Caller has no knowledge 

of callee's ISA 
. Callee has no knowledge 

of ISA to which it will return 




Flat 32-bit "Near" Address Space 




|86 RISC transition: 
imap x86 call to RISC 



32^ 



RISC x86 transition: 
mapx86 return to RISC 
31^ CFJg.SO 



no ISA transition: 
no mapping required 
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Flat 32-bit "Near" Address Space 




RISC -> x86 transition: 
map RISC call to x86 



x86-^ RISC transition: 
map RISC return to x86 

i__3g.9.332- CF:g■3v^) 



no ISA transition: 
no mapping required 
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Flat 32-bit "Near" Address Space 



RISC — I 



calL?" 



x86 




x86^ RISC transition: 
map RISC return to x86 



RISC-* x86 transition: 
map RISC call to x86 
3^3 -34& (.f^^^.3\) 



no ISA transition: 
no mapping required 
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• 



Flat 32-bit "Near" Address Space 



x86 



calL?' 



RISC 



r— RISC — I 




RISC -4 x86 transition: 
map x86 return to RISC 

342. 



x86^ RISC transition: 
map x86 call to RISC 

^2 (f 'ti- 



no ISA transition: 
no mapping required 



F3 . 3f 
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I 

x86 Preamble: 3^2 
(need not be inline) 

- Load register args 

- Fill-in RXA (return transfer argument area) 



General_Entry: 



YES 



3\7 



XD == 0? 



NO 



Native Entry: — ^ 

NativePreamble: 
(typically vacuous) 



Varargs 

AP for a very big argument list 



3\S 



! omit if j 
■ NATIVE_ONLY j 





Function Body: 






setupXD: 

XD <r- <descriptor_constant> 






RET 





X86-to-Tapestry transition exception handler 

,/ Tins handler is entered under the following condmons'. 

1 M x86 caller invokes a native functton 
,/ 2. An x86 function "les 2 tormpted native function following 

// 3. x86 software returns to <"^"^^'^' Zr exception, or a context switch 
// an external asynchronous interrupt, a proce 

disoatch-^n 4e two least-significant bits of the destination address ( 

^tsP //address of first argument - 32* \ 
^ : 1^ S // "r^rSol" ode B^lundar, _ *7 
SP ^ SP & (-32) // round f * P°X u^X86 calling conventions -328 . 

XD^O ""f°"^,tLts"pnSuringexecrt^^^ ^ 

_^..or // resuming an X86 thread suspen ^^^j^j^^„j,f 

^if the redundant copies "f'^^Zt^XEBl^^^^ ESI:EDI do not match ( 3 
m } . -^^M hit exception handler temporary register -7573 

if save slot's timestamp does not match tne sa detected 

Lb^^-^r;^™X8.c.leet<^^e.^ 

= RV0<63 :32>^edx<31:00> on hk Sorm to 64.bit form in RVDP 

convert the FP top-of-stack value from 80 b. X 6 form t^^^ ^^^^ _ J 

SP ^ ESI . ^ ^ .j^e J^Xe caller, load large result from men^ry 1 

RV0..RV3 <- load 32 bytes from [ESI-32] ^-5^7 J 



case "11 
RV( 

SP<-ESI 



IpC^EPC&-4 //resetthetwolow-orderbitstozero-'i^** 
RFE ^ 336 



Fig. 3h 
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Tapestry-to-X86 transition exception handler 

// This handler is entered under the following conditions: 
// 1. a native caller invokes an x86 function 
// 2. a native function returns to an x86 caller 
switch on XD<3:0> { 3*^. \^ 

XD_RET_FP: // result type is floating point 

FO/Fl <- FINFLATE.de( RVDP ) // X86 FP results are 80 bits 
SP <r- from RXA save // discard RXA, pad, args 

FPCW <- image after FINIT & push // FP stack has 1 entry 
goto EXIT 



XD_RET_WRITEBACK: // store result to @RVA, leave RVA in eax 

RVA <- from RXA save // address of result area 

copy decode(XD<8:4>) bytes from RV0..RV3 to [RVA] 
eax <- RVA // X86 expects RVA in eax 

SP <r- from RXA save // discard RXA, pad, args 

FPCW <- image after FINIT // FP stack is empty 

goto EXIT 

XD_RET_SCALAR: // result in eax:eda 

edx<3 1 :00> <- eax<63 :32> // in case result is 64 bits 

SP <r- from RXA save // discard RXA, pad, args 

FPCW <- image after FINIT // FP stack is empty 

goto EXIT y 



XD_CALL_HIDDEN_TEMP: // allocate 32 byte aligned hidden temp 
m esi <- SP // stack cut back on return — • 3«f5 

Li.| SP <- SP - 32 // allocate max size temp ~y 

□ RVA<-SP //RVA consumed later by RR 3 

LR< 1 :0> <- " II " //flag address for return & reload 34S 

=iJ goto CALL_COMMON 



// remaining XD_CALL_xxx encodings 

// stack cut back on return 34-3 
// flag address for return 3<44i 



default: 
esi i- SP 
LR<1:0><-"10" 
CALL_COMMON: 

interpret XD to push and/or reposition args "^47 
[~SP] <- LR // push LR as return address 

EXIT: 

setup emulator context and profiling ring buffer pointer 
^ RFE // to original target 



Fig.3i 
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interrupt/exception handler of Tapestry operating system: ^ 

II Control vectors here when a synchronous exception or asynchronous interrupt is to be 
// exported to / manifested in an x86 machine. 



// The interrupt is directed to something within the virtual X86, and thus there is a possibility 
// that the X86 operating system will context switch. So we need to distinguish two cases: 
// either the running process has only X86 state that is relevant to save, or 
// there is extended state that must be saved and associated with the current machine context 
// (e.g., extended state in a Tapestry library call in behalf of a process managed by X86 OS) 
if execution was interrupted in the converter - EPC.ISA = X86 { 

// no dependence on extended/native state possible hence no need to save any r 3Sl. 
goto EM86_Deliver_Interrupt( interrupt-byte ) J 
} else if EPC.Taxi_Active { 

// A Taxi translated version of some X86 code was running. Taxi will rollback to an 
// x86 instruction boundary. Then, if the rollback was induced by an asynchronous external 
// interrupt Taxi will deliver the appropriate x86 interrupt. Else, the rollback was induced 
// by a synchronous event so Taxi will resume execution in the converter, retriggering the 
// exception but this time will EPC.ISA = X86 
goto TAXi_Rollback( asynchronous-flag, interrupt-byte ) 
} else if EPC.EM86 { ' — 



1 



} ^ { 



// The emulator has been interrupted. In theory the emulator is coded to allow for such ^ 
// conditions and permits re-entry during long running routines (e.g. far call through a gate) 
// to deliver external interrupts 
goto EM86_Deliver_Interrupt( interrupt-byte ) 



// This is the most difficult case - the machine was executing native Tapestry code on 
// behalf of an X86 thread. The X86 operating system may context switch. We must save 
// all native state and be able to locate it again when the x86 thread is resumed. 

allocate a free save slot; if unavailable free the save slot with oldest timestamp and try again 
save the entire native state (both the X86 and the extended state) "7 3^*2. 



save the X86 EIP in the save slot ^ 
overwrite the two low-order bits of EPC with "01" (will become X86 interrupt EIP) 



3^.3 



store the 64-bit timestamp in the save slot, in the X86 EBX:ECX register pair (and, 7 
for further security, store a redundant copy in the X86 ESI:EDI register pair) o 

store the a number of the allocated save slot in the X86 EAX register (and, again for ? -s^g 
further security, store a redundant copy in the X86 EDX register) \ 

goto EM86_Deliver_Interrupt( interrupt-byte ) -v_- -j^^ 



350 



Fig. 3j 
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typedef struct { 
save_sIotJ * 
save_slot_t * 
unsigned int64 
unsigned int64 
unsigned int64 

timestanip_t 
int 

boolean 
} save_slot J; 



newer; 
older: 



// pointer to next-most-recently-allocated save slot 
// pointer to next-older save slot 
epc; // saved exception PC/IP 

pew; // saved exception PCW (program control word) 

registers[63]; // save the 63 writeable general registers 

// other words of Tapestry context 
timestamp; // timestamp to detect buffer overrun 
save_slot_ID; // ID number of the save slot ~ 3^7 
save_slot_is_fiill; // fiill / empty flag 3S»9 




379 c- 



3SC. 



save_slot_t * 
save slot t * 



save_slot_head; 
save_slot_tail; 



// pointer to the head of the queue 
// pointer to the tail of the queue 



- 37^3. 
-3>-7S>b 



system initialization 

reserve several pages of unpaged memory for save slots 



Fig. 3k 
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-bit "Near" Addres^rpace 




^x86 sw 

, — Handler: RISC to x86 

XD contains return-descriptor: 



. Interpret XD: 

- Reformat / repostion result 

- Load FPCW 
^ SP <2_[SP] // pop RA & args^^' 

XD contains call-descriptor: 



I 



ESI <- SP 



/ I 
I 



\ 
\ 

\ 



. x86 regs points to save slot 
. Using TS verify no ovenA/rite 
. Restore full state 
. Free save slot 
^EPC<1;0>_<-_00 ^1 

EPC<1:0> = 1x: ^ ^ 



Reformat / repostion the 



Interpret XD, reposition args * ^ - - J function result per EPC<0> 
. LR<1:0><- IxperXD j 
. Push LR as RA (ret addr) i h ' 



SP ^ ESI 
EPC<1:0> 



00 



Flat 32-bit "Near" Address Space 




r 

— Handler: RISC to x86 — 

XD contains return-descriptor: 



. Interpret XD: 

- Reformat / repostion result 

- Load FPSW 

. SP <- [SP] // pop RA & args4i^^ 
XBcoritaiiis cailndl^^np^ 
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Flat 32-bit "Near" Address Space 1 
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Flat 32-bit "Near" Address Space 




Q 



r 



® 



r-r ■ Handlei-LRISjC^to x86 
xbbbntainsYeturri-'descriDtd^^ 



XD contains call-descriptor: 



ESI <- SP 

Interpret XD,reposition args 
LR<1:0><- (^perXD 
Push LR as RA (ret addr) i 




EPG<1:0>-=.01.^|^y^ , , 




EPC<1:0>=(jx 



Reformat / repostion the 
function result per EPC<0> 
.SP^ESI 3|9 
. EPC<1:0>«- 00 "22^ I 
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/emtilatbr:; 



T 



page frame X j 

frstor 




page frame Y 



page frame Z 



-_>7 



iFlnai edge^re^ 



7 entry trace packet 




r 



J 









'^1 


-1 






Source 


Code 

42? 


Event 


Reuse event code 


Profileable event 


Initiate packet 


Probeable event 


Probe event bit - 
ITLB probe attribute 
or 

Emulator probe 




0.0000 


Default (x86 transparent) event, reuse all converter values 


yes 










0.0001 


Simple x86 instruction completion (reuse event code) 


yes 




f\V 


€loc^e. 1 




0.0010 


Probe exception failed 


yes 








O.OOIl 


Probe exception failed, reload probe timer 


yes 












0.0100 




no 


no 


no 


no 




s 


0.0101 


Sequential; execution environment changed " force- e%^ew4" 


no 


yes 


no 


no 




g 


O.OIIO 


Far RET 


no 


yes 


yes 


no 






0.0111 


IRET 


no 


yes 


no 


no 






0.1000 


Far CALL 


no 


yes 


yes 


yes 


Far call 


E (Cont 


0.1001 


FarJMP 


no 


yes 


yes 


no 




0.1010 


Special; emulator execution, supply extra instruction data" 


no 


yes 


no 


no 






0.1011 


Abort profile collection 


no 


no 


no 


no 






0.1100 


x86 synchronous/asynchronous interrupt w/probe (GRP 0) 


no 


yes 


yes 


yes 


Emulator probe 




0.1101 


x86 synchronous/asynchronous interrupt (GRP 0) 


no 


yes 


yes 


no 






0.1110 


x86 synchronous/asynchronous interrupt w/probe (GRP 1) 


no 


yes 


yes 


yes 


Emulator probe 




0.1111 


x86 synchronous/asynchronous interrupt (GRP 1) 


no 


yes 


yes 


no 






1.0000 


IP-relative JNZ forward (opcode: 75, OF 85) 


no 


yes 


yes 


no 






1.0001 


IP-relative JNZ backward (opcode: 75, OF 85) 


no 


yes 


yes 


yes 


Jnz 




1.0010 


IP-relative conditional jump forward - (Jcc, Jcxz, loop) 


no 


yes 


yes 


no 






1,0011 


IP-relative conditional jump backward - (Jcc, Jcxz, loop) 


no 


yes 


yes 


yes 


Cond jump 




1.0100 


IP-relative, near JMP forward (opcode: E9, EB) 


no 


yes 


yes 


no 




e 

«i 


1.0101 


IP-relative, near JMP backward (opcode: E9, EB) 


no 


yes 


yes 


yes 


Near jump 


ar_Edgc 


1.0110 


RET/ RET imml6 (opcode C3. C2 /w) 


no 


yes 


yes 


no 




1.0111 


IP-relative, near CALL (opcode: E8) 


no 


yes 


yes 


yes 


Near call 




1.1000 


REPE/REPNE CMPS/SCAS (opcode: A6, A7. AE, AF) 


no 


yes 


no 


no 




u 
t 


1.1001 


REP MOVS/STOS/LDOS (opcode: A4. A5, AA. AB, AC, AD) 


no 


yes 


no 


no 




Si 
e 


1.1010 


Indirect near JMP (opcode: FF /4) 


no 


yes 


yes 


no 






1.1011 


Indirect near CALL (opcode: FF /2) 


no 


yes 


yes 


yes 


Near call 




1.1100 


load from I/O memory (TLB.asi != 0) { not used in T2 } 


no 


yes 


no 


no 






1.1101 




\ l^D 




r\o 


no 






1.1110 


TjPTjllllt pnnvprfpr ^v^nt* cAniiAnti'il t^t^^^ 
i^CiaUll ^UUVCllCI CVCIll, oCUUCIlUdi 


no 


no 


no 


no 






1.1111 


New page (instruction ends on last byte of a page frame or 
straddles across a page frame boundary) 


no 


yes 


no 


no 





a. Used by emulator for new x86 opcodes. Extra information supplied in TaxijControlspecialj)pcode bits. 
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last converter 
recipe instruction 
completes 
from W stage 



to W stage to update 
Event Code Latch 



Fi J. 5b 



Event code from RFE restarting converter 
or mapping of converter's x86 opcode 



RFE or previous converter cycle 



Use latched 



Event Code Latch — rfe event code 



RFE Event 
Decode 



Clear Taxi_State.pact 



Probe failed RFE 
► 



Probe timer reload 
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Next (ws target) 
page properties 
from l-TLB 



Table 3 



ir^ Event Code _ 
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Next instruction cycle 



Initiate Packet ^18> 
— ► 



Profileable Event 4\6» 
► 



Probeable Event Co\o 
► 



I — TaxijControl. probe 



□00000 
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, l-TLB protected ig)6 

page property 



^ T/\X/ enabled 

for current x86 context 

Probel 



Decoded_Probe_Event < 
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ceo 



Probe_Mask 



Probe failed RFE: 



Clear corresponding Decoded_Probe_Event bit 

Probe timer reload 



Timer expired: 



Set ALL probe mask bits 



Probe timer 




650: 



670: 



672: 



674: 



690: 



U2: 



As each event occurs during execution of an X86 program in converter 136 or / 
emulator 3 1 6, materialize an event code in event code latch 486, 487 ^ 



PLA 650 processes the event code to produce at most one of five classifications 
of the event, "jnz" 660, "conditional jump" 661, "near jump" 662, "near call" 
663, "far call" 664, or "emulator probe" 665 , 



4 



The bit 660-665 is ANDed with the probe page properties 624 from TLB 116 
and Taxi State.Probe Mask 620 



T5R together the products of the ANDs. The sum ot the OR represents the 
predicate "the event code 592 is an event on a page whose probeable event bit is 
currently enabled in Taxi_State.Probe_Mask 620 and the TLB copy of the 
PFAT page propertie^/^ 



AND the sum of the OR together with several machine context predicates to see L 
if this is a probeable event j 

IK 



Consult the Dit vector to verify that the probeable event is in an address range 
with a corresponding translated code segment J /[ 



^7 4. 



Execute a TAXi instructionto materialize a Context^ATPoint entry descnbmg 
the current machine state, to supply arguments to the probe exception handler 

I 



y Deliver a probe exception to transfa^ontrol to the software exception handler ^ -^^^"^g^ ^o^^^^^^ 



Probe PIPM 602 for an entry 640 corresponding to the address of thetarget of \ 
the event ) 



was a PIPM entry found? j 



Evaluate/verify the preconditions from integer portion 686 of PIPM 602 entry 
640 
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Evaluate/verify the preconditions firom floating-point portion 688 of PIPM 
entry 640, and if mismatching, unload floating-point context and reload 
^^nf'^nn To PTPM 




Transfer control to the TAXi translated native code 
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Command 
Bit 
D 



M 



Bit 
Position 
T 



Meaning 

Disable -^^w^^^^r^A writes by clearing the UMU Enable flag 
livable monitoring of DMA writes by setUngJh^DMU^^ 



Reset all SMRs: clear all A and MPF bitsandc^^ the DMU Overrun flag 
Allocate an inactive SMR on a failed search 



Allow MPF modifications 



New MPFbiT^to record on successf ulsearch (or allocation) 
"/j % DMU Commands 
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Action 
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Inhibit modification of the MPF bit 
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Clear the corresponding MPF bit 


1 


I 


Set the corresponding MPF bit 
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Hich protection bits 
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address space ^ 
when SEG. PAGE is 1) ^^^^^ 
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cn.^o SEG. LIMIT base 
SE^-^ASE segment oa 



20 V,.o SE^-^ASE 

32 



f 



At code generation time: 



Case 1, little optimization: 

C 



0+> 



If this load is optimized, 



yg-S 



0 



1 



mark the conventional descriptor to indicate that it must be cloned in the prolog 



emit a load through the descriptor to be cloned by the code emitted at 866, 868, whose Taxi 
optimized load bit 810 is One. """^ 



H* — ^_ ^ — &^ 

else if the load is known to be (or believed to be) to non- well-behaved memory T 7YP5 

I J ^ ^ ^&t^ 



emit the load through the conventional segment descriptor used by the emulator, whose Taxi 
optimized load bit 810 is 204-0, 



else 



ai7 



choose a segment descriptor heuristically 



Case 2, aggressive optimization enabled: — 



If this load is optimized, | ) yckJ 



( t 

I emit a load through the conventional segment descriptor used by the emulator, whose Taxi 
^ j optimized lo ad bit 810 is One. 



else if the load is known to be (or believed to be) to non-well -behaved memory 




i 

else 



mark the conventional descriptor to indicate that it must be cloned in the prolog feSS 

emit the load through the descriptor to be cloned by the code emitted at 866, 868, whose Taxi ' 
optimized load bit 810 is Zero. 
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choose a segment descriptor heuristically \ 



TAXi code prolog generation by TAXi translator 

^862 



For each native X86 segment descriptor: 




one- 



JZ 



If this descriptor is marked to indicate that a cloned copy is required 
(reflection both optimized and unoptimized references through this segment 
^descriptor) then. 



e.lse.- 



r 



Emit code to copy one of the X86 segment descriptors to one of the 
segment descriptor registers reserved for TAXi code. The TAXi 
optimized load bit 810 of the segment descriptor is guaranteed to match 
TAXi_Control.tio 820 
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Emit code to explicitly set the value of the cloned descriptor's TAXi 
optimized load 810 to the opposite value. 



Emit code to implement the translated hot spot of the X86 code 



